Snort mailing list archives
Re: simple rule to alert when visiting a website
From: Joel Esler <jesler () sourcefire com>
Date: Tue, 17 Nov 2009 11:03:53 -0500
So, your question is, how to write a rule to detect someone going to eBay? J On Tuesday, November 17, 2009, mary andrews <maryandrews22 () gmail com> wrote:
Forgive us, but we are evaluating the software and we are now learning it too, OK, I suppose you can call us newbies. we are trying to write simple rules, we have had some success so far, a little at a time, we are now trying to write a small rule to alert if someone is visiting a specific site, say www.ebay.com <http://www.ebay.com/> so far we have this in a file called testing.rules. # testing.rules alert icmp any any -> any any (msg:"$$$$$TESTING rule$$$$$"; sid:1000001;) its rudimentary, we know, but its working ok. before we uncomment the config and include a bigger set of rules, we want to regresstion test them in their simplest form. if someone replies, and since I am not 100% sure how this list works yet, could you please copy me here? maryandrews22 () gmail com <javascript:_e({}, 'cvml', 'maryandrews22 () gmail com');> many thanks, m
-- Joel Esler | 302-223-5974 | gtalk: jesler () sourcefire com ------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what's new with Crystal Reports now. http://p.sf.net/sfu/bobj-july _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- simple rule to alert when visiting a website mary andrews (Nov 17)
- Re: simple rule to alert when visiting a website Joel Esler (Nov 17)
- Message not available
- Re: simple rule to alert when visiting a website Joel Esler (Nov 17)
- Message not available
- Fwd: simple rule to alert when visiting a website Joel Esler (Nov 17)
- Message not available
- Re: simple rule to alert when visiting a website Joel Esler (Nov 17)
- Re: simple rule to alert when visiting a website Joel Esler (Nov 17)
- Re: simple rule to alert when visiting a website JJ Cummings (Nov 17)